fortinet.fortimanager.fmgr_pkg_footer_policy – no description

fortinet.fortimanager.fmgr_pkg_footer_policy – no description

Note

This plugin is part of the fortinet.fortimanager collection (version 2.0.1).

To install it use: ansible-galaxy collection install fortinet.fortimanager.

To use it in a playbook, specify: fortinet.fortimanager.fmgr_pkg_footer_policy.

New in version 2.10: of fortinet.fortimanager

• Synopsis
• Parameters
• Notes
• Examples
• Return Values

Synopsis

• This module is able to configure a FortiManager device.
• Examples include all parameters and values which need to be adjusted to data sources before usage.

Parameters

Parameter			Choices/Defaults	Comments
bypass_validation boolean			no ← yes	only set to True when module schema diffs with FortiManager API structure, module continues to execute without validating parameters
pkg string / required				the parameter (pkg) in requested url
pkg_footer_policy dictionary				the top level parameters set
	action string		deny accept ipsec ssl-vpn	no description
	active-auth-method string		ntlm basic digest form	no description
	anti-replay string		disable enable	no description
	app-category string			no description
	app-group string			no description
	application integer			no description
	application-charts list / elements=string		top10-app top10-p2p-user top10-media-user	no description
	application-list string			no description
	auth-cert string			no description
	auth-method string		basic digest ntlm fsae form fsso rsso	no description
	auth-path string		disable enable	no description
	auth-portal string		disable enable	no description
	auth-redirect-addr string			no description
	auto-asic-offload string		disable enable	no description
	av-profile string			no description
	bandwidth string		disable enable	no description
	block-notification string		disable enable	no description
	captive-portal-exempt string		disable enable	no description
	capture-packet string		disable enable	no description
	casi-profile string			no description
	central-nat string		disable enable	no description
	cifs-profile string			no description
	client-reputation string		disable enable	no description
	client-reputation-mode string		learning monitoring	no description
	comments string			no description
	custom-log-fields string			no description
	deep-inspection-options string			no description
	delay-tcp-npu-session string		disable enable	no description
	delay-tcp-npu-sessoin string		disable enable	no description
	device-detection-portal string		disable enable	no description
	devices string			no description
	diffserv-forward string		disable enable	no description
	diffserv-reverse string		disable enable	no description
	diffservcode-forward string			no description
	diffservcode-rev string			no description
	disclaimer string		disable enable	no description
	dlp-sensor string			no description
	dnsfilter-profile string			no description
	dponly string		disable enable	no description
	dscp-match string		disable enable	no description
	dscp-negate string		disable enable	no description
	dscp-value string			no description
	dsri string		disable enable	no description
	dstaddr string			no description
	dstaddr-negate string		disable enable	no description
	dstaddr6 string			no description
	dstintf string			no description
	dynamic-profile string		disable enable	no description
	dynamic-profile-access list / elements=string		imap smtp pop3 http ftp im nntp imaps smtps pop3s https ftps ssh	no description
	dynamic-profile-fallthrough string		disable enable	no description
	dynamic-profile-group string			no description
	email-collect string		disable enable	no description
	email-collection-portal string		disable enable	no description
	emailfilter-profile string			no description
	endpoint-check string		disable enable	no description
	endpoint-compliance string		disable enable	no description
	endpoint-keepalive-interface string			no description
	endpoint-profile string			no description
	failed-connection string		disable enable	no description
	fall-through-unauthenticated string		disable enable	no description
	firewall-session-dirty string		check-all check-new	no description
	fixedport string		disable enable	no description
	forticlient-compliance-devices list / elements=string		windows-pc mac iphone-ipad android	no description
	forticlient-compliance-enforcement-portal string		disable enable	no description
	fsae string		disable enable	no description
	fsae-server-for-ntlm string			no description
	fsso string		disable enable	no description
	fsso-agent-for-ntlm string			no description
	geo-location string		disable enable	no description
	geoip-anycast string		disable enable	no description
	global-label string			no description
	groups string			no description
	gtp-profile string			no description
	http-policy-redirect string		disable enable	no description
	icap-profile string			no description
	identity-based string		disable enable	no description
	identity-based-policy list / elements=string			no description
		action string	deny accept	no description
		application-charts list / elements=string	top10-app top10-p2p-user top10-media-user	no description
		application-list string		no description
		av-profile string		no description
		capture-packet string	disable enable	no description
		deep-inspection-options string		no description
		devices string		no description
		dlp-sensor string		no description
		dstaddr string		no description
		dstaddr-negate string	disable enable	no description
		endpoint-compliance string	disable enable	no description
		groups string		no description
		icap-profile string		no description
		id integer		no description
		ips-sensor string		no description
		logtraffic string	disable enable all utm	no description
		logtraffic-app string	disable enable	no description
		logtraffic-start string	disable enable	no description
		mms-profile string		no description
		per-ip-shaper string		no description
		profile-group string		no description
		profile-protocol-options string		no description
		profile-type string	single group	no description
		replacemsg-group string		no description
		schedule string		no description
		send-deny-packet string	disable enable	no description
		service string		no description
		service-negate string	disable enable	no description
		spamfilter-profile string		no description
		sslvpn-portal string		no description
		sslvpn-realm string		no description
		traffic-shaper string		no description
		traffic-shaper-reverse string		no description
		users string		no description
		utm-status string	disable enable	no description
		voip-profile string		no description
		webfilter-profile string		no description
	identity-based-route string			no description
	identity-from string		auth device	no description
	inbound string		disable enable	no description
	inspection-mode string		proxy flow	no description
	internet-service string		disable enable	no description
	internet-service-custom string			no description
	internet-service-custom-group string			no description
	internet-service-group string			no description
	internet-service-id string			no description
	internet-service-negate string		disable enable	no description
	internet-service-src string		disable enable	no description
	internet-service-src-custom string			no description
	internet-service-src-custom-group string			no description
	internet-service-src-group string			no description
	internet-service-src-id string			no description
	internet-service-src-negate string		disable enable	no description
	ip-based string		disable enable	no description
	ippool string		disable enable	no description
	ips-sensor string			no description
	label string			no description
	learning-mode string		disable enable	no description
	log-unmatched-traffic string		disable enable	no description
	logtraffic string		disable enable all utm	no description
	logtraffic-app string		disable enable	no description
	logtraffic-start string		disable enable	no description
	match-vip string		disable enable	no description
	mms-profile string			no description
	name string			no description
	nat string		disable enable	no description
	natinbound string		disable enable	no description
	natip string			no description
	natoutbound string		disable enable	no description
	np-acceleration string		disable enable	no description
	ntlm string		disable enable	no description
	ntlm-enabled-browsers string			no description
	ntlm-guest string		disable enable	no description
	outbound string		disable enable	no description
	per-ip-shaper string			no description
	permit-any-host string		disable enable	no description
	permit-stun-host string		disable enable	no description
	policyid integer			no description
	poolname string			no description
	profile-group string			no description
	profile-protocol-options string			no description
	profile-type string		single group	no description
	radius-mac-auth-bypass string		disable enable	no description
	redirect-url string			no description
	replacemsg-group string			no description
	replacemsg-override-group string			no description
	reputation-direction string		source destination	no description
	reputation-minimum integer			no description
	require-tfa string		disable enable	no description
	rsso string		disable enable	no description
	rtp-addr string			no description
	rtp-nat string		disable enable	no description
	scan-botnet-connections string		disable block monitor	no description
	schedule string			no description
	schedule-timeout string		disable enable	no description
	send-deny-packet string		disable enable	no description
	service string			no description
	service-negate string		disable enable	no description
	session-ttl integer			no description
	sessions string		disable enable	no description
	spamfilter-profile string			no description
	srcaddr string			no description
	srcaddr-negate string		disable enable	no description
	srcaddr6 string			no description
	srcintf string			no description
	ssh-filter-profile string			no description
	ssh-policy-redirect string		disable enable	no description
	ssl-mirror string		disable enable	no description
	ssl-mirror-intf string			no description
	ssl-ssh-profile string			no description
	sslvpn-auth string		any local radius ldap tacacs+	no description
	sslvpn-ccert string		disable enable	no description
	sslvpn-cipher string		any high medium	no description
	sso-auth-method string		fsso rsso	no description
	status string		disable enable	no description
	tags string			no description
	tcp-mss-receiver integer			no description
	tcp-mss-sender integer			no description
	tcp-reset string		disable enable	no description
	tcp-session-without-syn string		all data-only disable	no description
	timeout-send-rst string		disable enable	no description
	tos string			no description
	tos-mask string			no description
	tos-negate string		disable enable	no description
	traffic-shaper string			no description
	traffic-shaper-reverse string			no description
	transaction-based string		disable enable	no description
	url-category string			no description
	users string			no description
	utm-inspection-mode string		proxy flow	no description
	utm-status string		disable enable	no description
	uuid string			no description
	vlan-cos-fwd integer			no description
	vlan-cos-rev integer			no description
	vlan-filter string			no description
	voip-profile string			no description
	vpntunnel string			no description
	waf-profile string			no description
	wanopt string		disable enable	no description
	wanopt-detection string		active passive off	no description
	wanopt-passive-opt string		default transparent non-transparent	no description
	wanopt-peer string			no description
	wanopt-profile string			no description
	wccp string		disable enable	no description
	web-auth-cookie string		disable enable	no description
	webcache string		disable enable	no description
	webcache-https string		disable ssl-server any enable	no description
	webfilter-profile string			no description
	webproxy-forward-server string			no description
	webproxy-profile string			no description
	wsso string		disable enable	no description
rc_failed list / elements=string				the rc codes list with which the conditions to fail will be overriden
rc_succeeded list / elements=string				the rc codes list with which the conditions to succeed will be overriden
state string / required			present absent	the directive to create, update or delete an object
workspace_locking_adom string				the adom to lock for FortiManager running in workspace mode, the value can be global and others including root
workspace_locking_timeout integer			Default: 300	the maximum time in seconds to wait for other user to release the workspace lock

Notes

Note

• Running in workspace locking mode is supported in this FortiManager module, the top level parameters workspace_locking_adom and workspace_locking_timeout help do the work.
• To create or update an object, use state present directive.
• To delete an object, use state absent directive.
• Normally, running one module can fail when a non-zero rc is returned. you can also override the conditions to fail or succeed with parameters rc_failed and rc_succeeded

Examples

- hosts: fortimanager-inventory
  collections:
    - fortinet.fortimanager
  connection: httpapi
  vars:
     ansible_httpapi_use_ssl: True
     ansible_httpapi_validate_certs: False
     ansible_httpapi_port: 443
  tasks:
   - name: no description
     fmgr_pkg_footer_policy:
        bypass_validation: False
        workspace_locking_adom: <value in [global, custom adom including root]>
        workspace_locking_timeout: 300
        rc_succeeded: [0, -2, -3, ...]
        rc_failed: [-2, -3, ...]
        pkg: <your own value>
        state: <value in [present, absent]>
        pkg_footer_policy:
           action: <value in [deny, accept, ipsec, ...]>
           active-auth-method: <value in [ntlm, basic, digest, ...]>
           anti-replay: <value in [disable, enable]>
           app-category: <value of string>
           app-group: <value of string>
           application: <value of integer>
           application-charts:
             - top10-app
             - top10-p2p-user
             - top10-media-user
           application-list: <value of string>
           auth-cert: <value of string>
           auth-method: <value in [basic, digest, ntlm, ...]>
           auth-path: <value in [disable, enable]>
           auth-portal: <value in [disable, enable]>
           auth-redirect-addr: <value of string>
           auto-asic-offload: <value in [disable, enable]>
           av-profile: <value of string>
           bandwidth: <value in [disable, enable]>
           block-notification: <value in [disable, enable]>
           captive-portal-exempt: <value in [disable, enable]>
           capture-packet: <value in [disable, enable]>
           casi-profile: <value of string>
           central-nat: <value in [disable, enable]>
           cifs-profile: <value of string>
           client-reputation: <value in [disable, enable]>
           client-reputation-mode: <value in [learning, monitoring]>
           comments: <value of string>
           custom-log-fields: <value of string>
           deep-inspection-options: <value of string>
           delay-tcp-npu-session: <value in [disable, enable]>
           delay-tcp-npu-sessoin: <value in [disable, enable]>
           device-detection-portal: <value in [disable, enable]>
           devices: <value of string>
           diffserv-forward: <value in [disable, enable]>
           diffserv-reverse: <value in [disable, enable]>
           diffservcode-forward: <value of string>
           diffservcode-rev: <value of string>
           disclaimer: <value in [disable, enable]>
           dlp-sensor: <value of string>
           dnsfilter-profile: <value of string>
           dponly: <value in [disable, enable]>
           dscp-match: <value in [disable, enable]>
           dscp-negate: <value in [disable, enable]>
           dscp-value: <value of string>
           dsri: <value in [disable, enable]>
           dstaddr: <value of string>
           dstaddr-negate: <value in [disable, enable]>
           dstaddr6: <value of string>
           dstintf: <value of string>
           dynamic-profile: <value in [disable, enable]>
           dynamic-profile-access:
             - imap
             - smtp
             - pop3
             - http
             - ftp
             - im
             - nntp
             - imaps
             - smtps
             - pop3s
             - https
             - ftps
             - ssh
           dynamic-profile-fallthrough: <value in [disable, enable]>
           dynamic-profile-group: <value of string>
           email-collect: <value in [disable, enable]>
           email-collection-portal: <value in [disable, enable]>
           emailfilter-profile: <value of string>
           endpoint-check: <value in [disable, enable]>
           endpoint-compliance: <value in [disable, enable]>
           endpoint-keepalive-interface: <value of string>
           endpoint-profile: <value of string>
           failed-connection: <value in [disable, enable]>
           fall-through-unauthenticated: <value in [disable, enable]>
           firewall-session-dirty: <value in [check-all, check-new]>
           fixedport: <value in [disable, enable]>
           forticlient-compliance-devices:
             - windows-pc
             - mac
             - iphone-ipad
             - android
           forticlient-compliance-enforcement-portal: <value in [disable, enable]>
           fsae: <value in [disable, enable]>
           fsae-server-for-ntlm: <value of string>
           fsso: <value in [disable, enable]>
           fsso-agent-for-ntlm: <value of string>
           geo-location: <value in [disable, enable]>
           geoip-anycast: <value in [disable, enable]>
           global-label: <value of string>
           groups: <value of string>
           gtp-profile: <value of string>
           http-policy-redirect: <value in [disable, enable]>
           icap-profile: <value of string>
           identity-based: <value in [disable, enable]>
           identity-based-policy:
             -
                 action: <value in [deny, accept]>
                 application-charts:
                   - top10-app
                   - top10-p2p-user
                   - top10-media-user
                 application-list: <value of string>
                 av-profile: <value of string>
                 capture-packet: <value in [disable, enable]>
                 deep-inspection-options: <value of string>
                 devices: <value of string>
                 dlp-sensor: <value of string>
                 dstaddr: <value of string>
                 dstaddr-negate: <value in [disable, enable]>
                 endpoint-compliance: <value in [disable, enable]>
                 groups: <value of string>
                 icap-profile: <value of string>
                 id: <value of integer>
                 ips-sensor: <value of string>
                 logtraffic: <value in [disable, enable, all, ...]>
                 logtraffic-app: <value in [disable, enable]>
                 logtraffic-start: <value in [disable, enable]>
                 mms-profile: <value of string>
                 per-ip-shaper: <value of string>
                 profile-group: <value of string>
                 profile-protocol-options: <value of string>
                 profile-type: <value in [single, group]>
                 replacemsg-group: <value of string>
                 schedule: <value of string>
                 send-deny-packet: <value in [disable, enable]>
                 service: <value of string>
                 service-negate: <value in [disable, enable]>
                 spamfilter-profile: <value of string>
                 sslvpn-portal: <value of string>
                 sslvpn-realm: <value of string>
                 traffic-shaper: <value of string>
                 traffic-shaper-reverse: <value of string>
                 users: <value of string>
                 utm-status: <value in [disable, enable]>
                 voip-profile: <value of string>
                 webfilter-profile: <value of string>
           identity-based-route: <value of string>
           identity-from: <value in [auth, device]>
           inbound: <value in [disable, enable]>
           inspection-mode: <value in [proxy, flow]>
           internet-service: <value in [disable, enable]>
           internet-service-custom: <value of string>
           internet-service-custom-group: <value of string>
           internet-service-group: <value of string>
           internet-service-id: <value of string>
           internet-service-negate: <value in [disable, enable]>
           internet-service-src: <value in [disable, enable]>
           internet-service-src-custom: <value of string>
           internet-service-src-custom-group: <value of string>
           internet-service-src-group: <value of string>
           internet-service-src-id: <value of string>
           internet-service-src-negate: <value in [disable, enable]>
           ip-based: <value in [disable, enable]>
           ippool: <value in [disable, enable]>
           ips-sensor: <value of string>
           label: <value of string>
           learning-mode: <value in [disable, enable]>
           log-unmatched-traffic: <value in [disable, enable]>
           logtraffic: <value in [disable, enable, all, ...]>
           logtraffic-app: <value in [disable, enable]>
           logtraffic-start: <value in [disable, enable]>
           match-vip: <value in [disable, enable]>
           mms-profile: <value of string>
           name: <value of string>
           nat: <value in [disable, enable]>
           natinbound: <value in [disable, enable]>
           natip: <value of string>
           natoutbound: <value in [disable, enable]>
           np-acceleration: <value in [disable, enable]>
           ntlm: <value in [disable, enable]>
           ntlm-enabled-browsers: <value of string>
           ntlm-guest: <value in [disable, enable]>
           outbound: <value in [disable, enable]>
           per-ip-shaper: <value of string>
           permit-any-host: <value in [disable, enable]>
           permit-stun-host: <value in [disable, enable]>
           policyid: <value of integer>
           poolname: <value of string>
           profile-group: <value of string>
           profile-protocol-options: <value of string>
           profile-type: <value in [single, group]>
           radius-mac-auth-bypass: <value in [disable, enable]>
           redirect-url: <value of string>
           replacemsg-group: <value of string>
           replacemsg-override-group: <value of string>
           reputation-direction: <value in [source, destination]>
           reputation-minimum: <value of integer>
           require-tfa: <value in [disable, enable]>
           rsso: <value in [disable, enable]>
           rtp-addr: <value of string>
           rtp-nat: <value in [disable, enable]>
           scan-botnet-connections: <value in [disable, block, monitor]>
           schedule: <value of string>
           schedule-timeout: <value in [disable, enable]>
           send-deny-packet: <value in [disable, enable]>
           service: <value of string>
           service-negate: <value in [disable, enable]>
           session-ttl: <value of integer>
           sessions: <value in [disable, enable]>
           spamfilter-profile: <value of string>
           srcaddr: <value of string>
           srcaddr-negate: <value in [disable, enable]>
           srcaddr6: <value of string>
           srcintf: <value of string>
           ssh-filter-profile: <value of string>
           ssh-policy-redirect: <value in [disable, enable]>
           ssl-mirror: <value in [disable, enable]>
           ssl-mirror-intf: <value of string>
           ssl-ssh-profile: <value of string>
           sslvpn-auth: <value in [any, local, radius, ...]>
           sslvpn-ccert: <value in [disable, enable]>
           sslvpn-cipher: <value in [any, high, medium]>
           sso-auth-method: <value in [fsso, rsso]>
           status: <value in [disable, enable]>
           tags: <value of string>
           tcp-mss-receiver: <value of integer>
           tcp-mss-sender: <value of integer>
           tcp-reset: <value in [disable, enable]>
           tcp-session-without-syn: <value in [all, data-only, disable]>
           timeout-send-rst: <value in [disable, enable]>
           tos: <value of string>
           tos-mask: <value of string>
           tos-negate: <value in [disable, enable]>
           traffic-shaper: <value of string>
           traffic-shaper-reverse: <value of string>
           transaction-based: <value in [disable, enable]>
           url-category: <value of string>
           users: <value of string>
           utm-inspection-mode: <value in [proxy, flow]>
           utm-status: <value in [disable, enable]>
           uuid: <value of string>
           vlan-cos-fwd: <value of integer>
           vlan-cos-rev: <value of integer>
           vlan-filter: <value of string>
           voip-profile: <value of string>
           vpntunnel: <value of string>
           waf-profile: <value of string>
           wanopt: <value in [disable, enable]>
           wanopt-detection: <value in [active, passive, off]>
           wanopt-passive-opt: <value in [default, transparent, non-transparent]>
           wanopt-peer: <value of string>
           wanopt-profile: <value of string>
           wccp: <value in [disable, enable]>
           web-auth-cookie: <value in [disable, enable]>
           webcache: <value in [disable, enable]>
           webcache-https: <value in [disable, ssl-server, any, ...]>
           webfilter-profile: <value of string>
           webproxy-forward-server: <value of string>
           webproxy-profile: <value of string>
           wsso: <value in [disable, enable]>

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Returned	Description
request_url string	always	The full url requested Sample: /sys/login/user
response_code integer	always	The status of api request
response_message string	always	The descriptive message of the api response Sample: OK.

Authors

• Link Zheng (@chillancezen)
• Jie Xue (@JieX19)
• Frank Shen (@fshen01)
• Hongbin Lu (@fgtdev-hblu)

© 2012–2018 Michael DeHaan
© 2018–2021 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/ansible/2.11/collections/fortinet/fortimanager/fmgr_pkg_footer_policy_module.html